---

Digital Economy Bill [HL]

I thank the noble Lord, Lord Clement-Jones. He has brought a new dimension to streaming that I had not anticipated. The amendment would treat a copyright infringement report as sensitive personal data under the Data Protection Act 1998, and would require ISPs to be obliged to disclose a copyright infringement report on a subscriber on application by the subscriber. On the first part of the proposal, the data that are currently defined as sensitive personal data under the Data Protection Act cover issues such as race, political or religious views, mental and physical health matters, sex and criminal offences, and criminal offence proceedings. It is difficult to see how a copyright infringement notice might fit into this category of data: some of the content might, but not the actual copyright infringement notice itself. A CIR provides evidence of an apparent infringement of copyright that for the most part is a civil matter. It is difficult to see how the internet account of a particular subscriber could be any more of a sensitive, personal matter than, for example, a parking ticket for parking in a disabled bay a car that is registered to an individual. I assume that the intention behind the amendment is to constrain what can be done with a copyright infringement report once it has been matched to an individual subscriber. Existing data protection legislation provides sufficient protection. I stress that a copyright owner will be able to access the name and address of the subscriber only by asking a court to require the ISP to provide that information. Both ISPs and copyright owners will have to comply fully with any obligations and duties that apply under the Data Protection Act in respect of information that is part of or associated with a copyright infringement report. On the second part of the amendment, the whole purpose of the CIR is to trigger a notification to the subscriber that is likely to contain all relevant information in the copyright infringement report: that is, evidence of the copyright infringement, including the material copied, the time and date on which it took place, and the IP address identified. In the case of someone who continues to infringe copyright, CIRs are likely to reach the ISP that do not result in an immediate notification to the subscriber. In all cases, however, a certain number of CIRs will trigger a further notification letter—we are now talking about thresholds, to which we said we would return—that will tell the subscriber how many CIRs on his account have been received and the apparent infringements to which they relate. Under the Data Protection Act, a subscriber will be able to make a request to an ISP to see the personal data which it holds on that subscriber. This includes any CIRs on that person. There are certain circumstances under the Data Protection Act in which an exemption applies and the disclosure of personal data is not required. However, the exemptions are very limited and may not apply in the case of the CIR. I can see no good reason for treating the personal data in the CIR any differently from other types of personal data. The Data Protection Act is a complex regime, and it would be neither appropriate nor necessary to amend the regime in respect of these reports. I have given a detailed explanation. I must say that I tend to err on the side of believing that the glass is half full, but I do not go to the Panglossian extreme of believing that all is for the best in this best-of-all-possible worlds, although I hope it is.